Privacy Policy

1. Who the controller is

The controller of the personal data processed in this app is The Delusional Company Desenvolvimento de Software sob Encomenda Ltda., registered in Brazil under CNPJ no. 67.758.390/0001-34, headquartered at Rua Carvalho de Freitas, 325, Vila Andrade, São Paulo/SP, CEP 05728-030. Official contact channel: contact@morphihealth.com.

2. What data Morphi processes

Everything below is provided by you or calculated from what you log. The app does not store or send your location: when you ask for the nearest clinics, it reads your location to calculate the distance, on the device itself, and discards it. It does not read your calendar and does not access your contacts.

• Account — your email, which is how you sign in. When you sign in with Apple, we receive from Apple an identifier and, if you allow it, your email. When you sign in with Google, we receive from Google an identifier, your email, and the name and photo of your Google account.
• Identification — name or nickname, date of birth and how you identify yourself.
• Health data — height, weight, body measurements, vital signs, medication, dose, administration dates and sites, symptoms, sleep, mood, energy, lab tests and lab reports, health history (conditions, allergies and medications), dietary restrictions, documents and the notes you write.
• Habits — the meals, protein, hydration and exercise you log, and the workouts and exercise minutes we read from your phone’s health app, when you authorize it (section 9).
• Profile photo — when you choose one.
• Preferences — daily goals, reminder times, and the app’s language and theme.
• Questions to Morphi — what you ask inside the app, with the time and whether the question was typed by you or suggested by us. They stay only on the device: they don’t go to your account, to the clinic, or to us — except the question and answer you send us when you rate an answer poorly (below).
• Ratings of Morphi Intelligence answers — the 👍 or 👎 you give an answer. With 👎, if you confirm sending it, also the reason you chose, the question and answer being rated, the language and the country set on the device.
• Link with a clinic — when you connect to a partner clinic: the invite code, the clinic, who gave you the code, and the start and end dates.
• Subscription — when you subscribe: the plan, the dates (start, free trial, renewal and end), where you subscribed (the App Store, Google Play or the Morphi website) and whether there was a refund. Payment is made in the store or, on the website, through Stripe: your card never passes through us.
• Walking away from a purchase — when you close the store’s payment sheet without subscribing, we ask once what held you back, and keep with your account only the date we asked and, if you open the offer we show to those who found it too expensive, when it opened, when it ends and whether you subscribed through it. The reason you choose does not stay with your account: we keep only how many people gave each reason, per day, phone system, store country and language.
• Purchase on the website — when you subscribe on the Morphi website, the payment asks for your email, your card details, your country and, if requested, your billing address. They go straight to Stripe and RevenueCat (section 7); your account keeps only the status of the subscription, as with any store. The receipt (amount, currency, date and plan) stays with Stripe, in the company’s account.
• Consent record — the date and version of the notice you accepted, and the date on which you allowed or withdrew artificial intelligence.
• Access logs — the date, time and IP address of each sign-in to your account, which the law requires us to keep (section 10).

Most of this is sensitive personal data, as defined in art. 5, II of the LGPD (Brazil’s General Data Protection Law). That means a higher bar, which section 4 details.

3. Why we process it

• Keeping your journal — so it isn’t lost when you change or lose your device, and so it is on every device where you sign in to your account.
• Daily goals — to calculate protein, water and movement from your height, weight, goal and activity level.
• Tracking — to build the weight and measurement curves, the dose cycle, adherence to your doses and the patterns in your symptoms.
• Appointments — to organize the summary you take to your doctor.
• Sharing with your clinic — when you connect to a partner clinic, so that its team can follow your journal between appointments.
• Reminders — to trigger the alerts you set up yourself.
• Photo reading — to suggest the items on your plate when you photograph a meal.
• Lab report reading — to suggest the results of a lab test from the PDF or photo of the report, when you choose to have it read instead of typing.
• Improving Morphi Intelligence — to correct the answers you rated poorly and sent us.
• Subscription — to know whether your subscription is active, to unlock the app and artificial intelligence for those who have access, and to help when a purchase doesn’t show up.
• Walking away from a purchase — to show the question and the offer only once, so the offer’s deadline is the same on every device, and to understand, in numbers, why people decide not to subscribe.
• Legal obligations — when the law requires it of us.

None of this is a diagnosis. The app does not prescribe, does not adjust doses and does not replace the assessment of whoever is caring for you.

We do not sell data, we do not use your health data for advertising profiling, and we do not send it to ad networks.

4. Legal basis (LGPD arts. 7 and 11)

• Health data, and keeping it in your account — specific and prominent consent (art. 11, I). It is a step of its own, during sign-up, before your plan is built: the box "I agree to the processing of my health data", which you check after a notice that says what this data is and what will be done with it. It is separate from your acceptance of these documents, which comes afterward, with the Continue button.
• Sharing with the clinic you connect to — specific consent (art. 11, I), given on the code screen, before connecting, with the list of what the clinic will see and what it keeps seeing after the connection ends. Whatever the clinic copies into its own medical record falls under the protection of health, in procedures carried out by health professionals (art. 11, II, "f"), and under the medical-record rules that apply to it.
• Account, sign-up and operation of the app — performance of a contract (art. 7, V): without this data the app does not work.
• Subscription — performance of a contract (art. 7, V): it is what tells whether the access you purchased is active. Receipts for purchases on the website are also kept for compliance with a legal obligation (art. 7, II), under tax law.
• Walking away from a purchase — legitimate interest (art. 7, IX): our interest in understanding why the subscription didn’t happen and in offering a better deal to those who found it too expensive. It’s very little data, none of it about health, and you don’t have to answer; the reason is counted without your account.
• Artificial intelligence — the conversation with Morphi Intelligence, the weekly summary, lab report reading, meal photo reading and estimating a dish by its name — specific and prominent consent (art. 11, I), given once, the first time you use any of them, on a screen that lists each purpose, what leaves the device and where it goes. Without this consent, none of these features is used and nothing leaves the device. The weekly summary can be turned off in the summary itself, and the others only work when you ask. The whole consent can be withdrawn in Privacy and data › Artificial intelligence.
• Rating an answer — specific and prominent consent (art. 11, I), given each time you send one: the 👎 opens a sheet that says what is sent, and nothing is sent before you tap Send. The 👍 sends only the rating.
• Access logs — compliance with a legal obligation (art. 7, II): the Marco Civil da Internet (Brazil’s Internet Civil Rights Framework, art. 15) requires anyone offering an app to keep them.
• Reading your phone’s health app — consent, granted and withdrawn in the operating system’s settings.

You can withdraw each consent at any time, free of charge and without having to delete anything: the one for artificial intelligence, in Privacy and data › Artificial intelligence; the one for sharing, by disconnecting from the clinic; the one for reading the health app, in your phone’s settings. Your consent for us to keep your journal is withdrawn by deleting your account, because without it there is no account. Withdrawal does not invalidate what was done before it.

5. Where your data is kept

In two places: on your device, inside the app, and in our database, linked to your account. The database is hosted by Supabase, in the São Paulo region: your treatment history does not leave Brazil.

The app works offline, and saves to your account when the connection comes back. That is why uninstalling the app or switching devices does not lose your journal: it comes back when you sign in to your account. Anything logged offline that has not yet reached your account exists only on the device until then.

There is no password. You sign in with a six-digit code sent to your email, with Apple or with Google. The database rules only let your account read your journal — and the clinic you connect to, as section 6 explains.

6. What leaves your device

• The update check, every time you open the app — the app asks Expo’s servers whether there is a new fix. The check carries a random number for this installation, which is not your account’s, the app version and the device’s operating system. Nothing from your journal.
• Your journal, to your account — your entries, your profile (with the profile photo, reduced in size) and your consent go to our database automatically, whenever there is a connection. That is what keeps your journal across devices. Questions to Morphi are left out.
• What the clinic sees, when you connect — every type of entry (weigh-ins, doses, check-ins, meals, measurements, lab tests, lab reports, vital signs, documents, notes, personal goals and your medication containers) and your profile, with your health history, including what you logged before connecting. While the connection lasts, it sees everything. After the connection ends — whether you or the clinic ends it —, it keeps seeing only what you logged during the connection, and a copy of your profile as of the last day, without the app preferences, until you delete your account. Deleting your account also removes what the clinic could see; if it needs to keep part of it as a medical record, it keeps it in its own system, under its own rules. Questions to Morphi are not included.
• The meal photo, when you use photo reading — the image is reduced on the device and sent to be interpreted. It is not stored: neither in the meal entry, nor in the service that acts as intermediary.
• The lab report, when you use lab report reading — the PDF or photo of the test is sent to be interpreted, and comes back as a list of results that you check before saving. The whole file is sent, with whatever is printed on it — including your name and your ID numbers. It is not stored in your journal or in the service that acts as intermediary. All that remains are the results you saved, like any lab test you enter.
• The conversation with Morphi Intelligence, when you ask — the question, the latest messages in the conversation and a summary of your entries — treatment, height, weight, symptoms (including what you write in the "Other" field of the check-in), check-ins, meals with the items on the plate, water, exercise and lab tests — are sent to generate the answer, along with your first name and the country set on your device, which is used to give the right emergency and support numbers. The summary does not include your last name, your email, the name of whoever cares for you, your health history or your journal notes. None of this is stored in the service that acts as intermediary; the conversation stays only on your device and does not go to your account.
• The weekly summary, every Monday, after you accept artificial intelligence and until you turn it off — a summary of the past week (weight, doses, check-ins, symptoms, water, protein and workouts) and a finding calculated on your device, which may include a lab test or a body measurement, are sent to generate the summary, along with your first name and the country set on the device. Without your last name, your email, the name of whoever cares for you or your journal notes. None of this is stored in the service that acts as intermediary; the summary stays only on your device and does not go to your account.
• Rating an answer, when you rate one — the 👍 sends only the rating. The 👎, when you confirm, sends the reason, your question and the rated answer to our database in São Paulo. Nothing else from the conversation or from your entries.
• The name of a dish, when you ask for an estimate — only the typed name is sent, and it comes back as an estimated portion. It is not stored in the service that acts as intermediary.
• Your speech, when you use the microphone — speech recognition is done by the device’s operating system. We ask for it to happen on the device itself, but when the device does not have on-device recognition for your language, the system may send the audio to Apple’s or Google’s servers. This only happens while the microphone is on.

In all the transmissions to artificial intelligence above — the meal photo, the lab report, the conversation, the weekly summary and the dish name —, the service that acts as intermediary, which is ours, keeps nothing, and Anthropic keeps what it receives for up to 30 days, for safety, and then deletes it (section 7).

The appointment summary is built on the device and leaves it when you show or export it. Logging a meal manually sends nothing beyond the entry, which goes to your account like the rest of the journal.

7. Sharing with third parties

We share data strictly with processors that make Morphi work. Next to each one is the country where the data is processed; those outside Brazil also appear in section 8:

• Supabase (database, authentication and storage) · Brazil, São Paulo — keeps your account, your journal and your subscription status, in the São Paulo region.
• Resend (email delivery) · United States — delivers the sign-in code to your email. It receives the address and the code, and nothing else from your journal.
• Apple · United States — when you choose to sign in with Apple, it confirms who you are and gives us an identifier and, if you allow it, your email.
• Google · United States — when you choose to sign in with Google, it confirms who you are and gives us an identifier, your email, and the name and photo of your Google account.
• Vercel (infrastructure) · Brazil — hosts the functions that act as intermediary for meal photo reading and lab report reading, estimating a dish by name, the weekly summary and the conversation with Morphi Intelligence, on servers in Brazil. It does not keep the image, the lab report or the conversation, and holds no database of ours.
• Anthropic (AI model) · United States — interprets the meal photo and the lab report, estimates a dish by its name, and writes Morphi Intelligence’s answers and weekly summary. Under its contract, Anthropic does not use what it receives — the image, the lab report, the conversation — to train models, and deletes inputs and outputs within 30 days — or keeps for up to 2 years what its safety system flags as a violation of its usage policies, or what the law requires.
• Expo (app updates) · United States — delivers fixes to the app without going through the store. Each time you open the app, it receives a random installation number, the app version and the device’s operating system, which it uses to know whether there is a fix and to count updated devices. It receives nothing from your journal or your account.
• RevenueCat (subscriptions) · United States — sits between the app and whoever charges you — the App Store, Google Play or payment on the website: it receives your account identifier and your purchases (plan, dates, where you subscribed) and tells us whether your subscription is active. For purchases on the website, it shows the payment page and the portal where you cancel, and also receives your email and your country. It receives nothing from your journal.
• Stripe (payment on the website) · United States — when you subscribe on the website, it charges the card, renews, refunds and issues the receipt, on behalf of the company. It receives your email, your card details, your country and, if requested, your billing address. The card details stay with Stripe: we neither receive nor keep them. It receives nothing from your journal.
• Apple and Google, as stores · United States — when you subscribe in the app, the App Store or Google Play charges you, renews and keeps the purchase history, under their own rules.
• The clinic you connect to — what section 6 lists: everything while the connection lasts, and afterward only what was logged during it, until you delete your account.
• Public authorities, when there is a legal obligation or a court order, and only what is strictly required.
• Whoever succeeds the company — in a merger, sale or corporate reorganization, the data passes to whoever takes over Morphi, who is bound by this policy. We will notify you beforehand, and you can delete your account if you do not want to continue.

We do not use third-party tools for telemetry, analytics or error monitoring, and we do not read the questions you ask Morphi — except those you send us when you rate an answer poorly. We do not share with advertisers, data brokers or third parties for marketing purposes.

8. International transfer

The database with your journal is located in Brazil, in São Paulo.

Eleven things may be processed by providers based in the United States, which constitutes an international transfer under art. 33 of the LGPD:

• The meal photo, only when you use photo reading. It involves only the image sent, which our service does not keep and Anthropic deletes within 30 days (section 7). If you prefer this not to happen, log your meals manually.
• The lab report, only when you use lab report reading, and after you accept artificial intelligence. It involves the whole file, as it is, which our service does not keep and Anthropic deletes within 30 days (section 7). If you prefer this not to happen, enter your lab tests by hand.
• The conversation with Morphi Intelligence, only when you ask, and after you accept artificial intelligence. It involves the question, the latest messages and the summary of entries described in section 6, which our service does not keep and Anthropic deletes within 30 days (section 7). If you prefer this not to happen, do not turn on the conversation.
• The weekly summary, after you accept artificial intelligence and until you turn it off. It involves the summary of the week and the finding described in section 6, which our service does not keep and Anthropic deletes within 30 days (section 7). If you prefer this not to happen, turn off the summary.
• The name of a dish, when you ask for an estimate. Only the typed name.
• Your email, which the delivery service uses to deliver the sign-in code.
• The Apple identifier, when you choose to sign in with Apple.
• The Google identifier, when you choose to sign in with Google.
• Your account identifier and your purchases, when you subscribe, which RevenueCat processes to know whether your subscription is active.
• Website purchase data, when you subscribe there — the email, the card, the country and, when required, the billing address —, which Stripe processes to charge you and RevenueCat processes to show the payment page and the subscription portal. If you prefer this not to happen, subscribe in the app, through the store.
• The update check, each time you open the app: the random installation number, the app version and the device’s operating system, which Expo receives to deliver fixes.

Each has its own basis in art. 33: the meal photo, the lab report, the conversation, the weekly summary and the dish name depend on your specific and prominent consent (item VIII), the acceptance of artificial intelligence, and without it none of this leaves the device. The sign-in email, the Apple and Google identifiers, the subscription, the website purchase and the update check are necessary to perform the contract with you (item IX, together with art. 7, V). In addition, each provider commits by contract to protect what it processes for us.

9. Phone health apps

With your authorization, Morphi reads the weigh-ins and workouts recorded in Apple Health (iPhone) or Health Connect (Android) — which is how the numbers from your scale, your watch or another app arrive. On iPhone, it also reads the day’s exercise minutes. For each workout, it reads the type, the start time and the duration.

The reading covers only weight, workouts and exercise minutes — sleep, steps, heart rate and everything else are left out —, and Morphi never writes anything to these apps. What is read enters your journal just like what you log, and is kept in your account. Authorization is granted and withdrawn in the system settings, at any time, and can be given for one type of data and not another; without it, you log weight and workouts yourself and everything else stays the same.

What comes from Apple Health or Health Connect is used only for your tracking within the app. We never use it for advertising, marketing or data mining, we never sell it or pass it to data brokers, ad networks or any third party for those purposes, and it only reaches artificial intelligence as part of the summary of your entries, in the features you accepted (section 6).

10. How long we keep it

• The account and the treatment entries — as long as your account exists. You delete each entry where it appears, and everything at once in Privacy and data › Delete account, which deletes the account, from our database and from this device, immediately. If you signed in with Apple, deleting the account also undoes the link with your Apple ID.
• Database backups — keep what was deleted for up to 7 days, and then disappear on their own. They exist to recover the database from a failure, and are not used for anything else.
• Another device where you signed in — keeps the local copy of the journal until you sign out of your account on it, or until it is back online and learns that the account was deleted.
• Questions to Morphi — only on the device, which keeps the 12 most recent. They do not go to the account.
• Ratings of answers — up to 12 months, and then they are deleted. Deleting your account deletes yours immediately. They are not included in the copy of your data; to request yours, write to our contact channel.
• Meal photo — we do not keep it. It exists in our service during the call and is discarded.
• Lab report sent for reading — we do not keep it. It exists in our service during the call and is discarded; only the results you saved remain in the journal.
• What goes to artificial intelligence — the photo, the lab report, the conversation, the weekly summary and the dish name: our service does not keep it, and Anthropic deletes it within 30 days, or keeps for up to 2 years what its safety system flags (section 7).
• What the clinic sees — until you delete your account (section 6). Whatever it has copied into its own medical record follows the medical-record rules that apply to it, and the request to delete that is made to the clinic.
• Consent record — as long as the account exists, because it is the proof that consent was given and in which version.
• Access logs — 6 months, kept confidential, as required by the Marco Civil da Internet (art. 15), and then deleted. They are only released by court order.
• The subscription — as long as the account exists. Deleting the account deletes our copy and asks RevenueCat to delete its own. The App Store or Google Play purchase history belongs to the store and follows its rules. And deleting the account does not cancel the subscription: cancellation is done in the store or, if you subscribed on the website, in the subscription portal.
• Walking away from a purchase — the dates of the question and the offer, as long as the account exists; deleting the account deletes them. The count of reasons has no account and no time, and it stays.
• Receipts for website purchases — the amount, currency, date, plan and purchase email stay with Stripe, in the company’s account, for 5 years, the period set by Brazilian tax law, even after you delete your account. Card details never reach us.

11. Your rights (LGPD art. 18)

You may, at any time:

• Confirm that processing takes place and access your data — the app shows everything you have logged.
• Correct incomplete, inaccurate or outdated data — every entry can be edited where it appears.
• Request anonymization, blocking or deletion of data that is unnecessary or processed unlawfully.
• Take your data with you, in a structured, machine-readable format — Privacy and data › A copy of your data. The file includes everything your account keeps, plus the questions to Morphi on this device.
• Delete the data processed with your consent — Privacy and data › Delete account, which deletes the account and everything it keeps (subject to the caveat about backups in section 10).
• Know who we share with, which is in section 7.
• Withdraw consent, and be informed of the consequences of not giving it — for artificial intelligence in Privacy and data › Artificial intelligence, and the others as section 4 explains.
• Object to processing carried out without consent.

Access, correction, portability and deletion are inside the app and do not depend on a request. For the others, or if you would rather talk to a person, write to contact@morphihealth.com. We respond within 15 days.

12. Automated decisions and human review (art. 20)

Four parts of the app are produced by machine. Three use artificial intelligence: meal photo reading, lab report reading and Morphi Intelligence’s answers and weekly summary. The fourth, the findings, are calculations made on your device from your own entries (including the finding in the weekly summary), which point out patterns — coincidences in what you logged, not causes. All of them can be wrong.

None of them decides anything about your treatment — the photo list and the lab report results go to you to check before saving, the findings are information, not medical guidance, and Morphi Intelligence neither suggests nor changes doses. Even so, you can contest any of them and request review by a person: write to contact@morphihealth.com.

Do not make decisions about doses, symptoms, allergies or dietary restrictions based only on what the machine wrote. Confirm with your care team.

13. Cookies and trackers

Morphi does not use third-party cookies, tracking pixels, advertising identifiers or third-party analytics tools. We do not use Google Analytics, Meta Pixel or anything similar.

14. Security

On the device, data is kept in the app’s private storage area, protected by the operating system. Your account session is stored encrypted, with the key in the system’s secure vault (Keychain on iPhone, Keystore on Android).

In the database, each row has a rule that says who may read it: your account reads your journal, and the clinic you connected to reads what section 6 lists, for as long as section 6 says. All traffic, to the database and to artificial intelligence, is encrypted over HTTPS.

There are limits wherever someone might try to guess: the sign-in code can only be checked a limited number of times within a few minutes, and the clinic invite code locks after repeated errors. And use of artificial intelligence has a per-person cap.

No system is impregnable, and we do not promise otherwise. In the event of a security incident that may cause significant risk or harm, we will notify the ANPD (Brazil’s National Data Protection Authority) and the people affected, within 3 business days of learning of it, in accordance with art. 48 of the LGPD and ANPD Resolution CD/ANPD No. 15/2024, and the authorities of other countries within the deadlines of their laws (72 hours in the European Union and the United Kingdom), stating what data was affected, who was affected, what risks this brings and what we did to contain and reverse the harm.

The security of your device is part of this: keeping a screen lock and the operating system up to date protects what is stored here.

15. Minors

Morphi is exclusively for people aged 18 or older and is not intended for children or adolescents. We do not knowingly process data from minors.

Parents, guardians or anyone who identifies an account belonging to a minor can request its immediate deletion at contact@morphihealth.com.

16. Changes to this policy

When we expand Morphi’s features, this policy will be updated. Significant changes — a new purpose, a new recipient — are announced inside the app before they take effect, and we ask for your consent again when appropriate.

The version and the effective date are at the top of this page.

17. Data Protection Officer and contact

The Data Protection Officer (Encarregado pelo Tratamento de Dados Pessoais), under art. 41 of the LGPD and Resolution CD/ANPD No. 18 of July 16, 2024, is appointed by The Delusional Company Desenvolvimento de Software sob Encomenda Ltda. and can be contacted through the official channel: contact@morphihealth.com.

You may also file a complaint with the National Data Protection Authority (ANPD), at gov.br/anpd.

18. People who sign up for Morphi Professional

The Morphi website has a form for doctors, nutritionists, other health professionals and clinics, from any country, who want to express interest in Morphi Professional and be notified when it arrives in their country. It is not part of the app, and those who fill it out do not need an account.

We keep what the person leaves there: name, email, country and profession, with the date and the language of the website. This is not health data.

We use this data only to notify you about Morphi Professional, talk about it and learn in which countries it is most awaited, based on your consent (LGPD, art. 7, I; and, for people in the European Union, the European Economic Area or the United Kingdom, GDPR, art. 6(1)(a)), given when you submit the form, with the notice right below the button. We do not sell it, do not use it for advertising and do not combine it with anything from the app.

It is kept in the same database as the app, on Supabase, in São Paulo, and only our team reads it. We keep it until Morphi Professional launches in your country and for 12 months after that, or until you ask us to delete it through contact@morphihealth.com — whichever comes first. If you are outside Brazil, the rights in section 19 also apply.

19. If you live outside Brazil

Morphi is used in several countries. This policy follows Brazilian law, and the mandatory data protections of the country where you live also apply: nothing here reduces the rights that local law guarantees you.

• European Union, European Economic Area and United Kingdom — processing also follows the GDPR (and the UK GDPR). The legal bases, for people there: performance of a contract (art. 6(1)(b)) for the account, the subscription and running the app; your explicit consent (art. 9(2)(a)) for health data, sharing with the clinic, artificial intelligence, reading your phone’s health app and response ratings; and our legitimate interest (art. 6(1)(f)) for access logs and receipts, which Brazilian law requires us to keep, for the question and the offer when you walk away from a purchase, and for security. Without the account and sign-up data the app does not work; everything that depends on consent is optional. You have the rights of access, rectification, erasure, portability, restriction and objection, and you can withdraw consent at any time. Your data is processed in Brazil, which the European Commission recognizes as providing adequate protection (decision of January 26, 2026). What goes to the providers in section 8, in the United States, relies on the European Commission’s standard contractual clauses, which are part of each provider’s data processing agreement — with the UK addendum for people in the United Kingdom — or on the provider’s certification under the EU-US Data Privacy Framework; you can ask for a copy through our channel. You can complain to the data protection authority of your country.
• United States — the rights under the state privacy and health data laws where you live apply, such as California’s CCPA/CPRA and Washington’s My Health My Data Act: to know what we keep, to request a copy and deletion, and not to be discriminated against for exercising these rights. We do not sell or share personal data for advertising. Residents of Washington, Nevada or Connecticut also have our Consumer Health Data Privacy Policy, next to this one in the app and on the Morphi website.
• Other countries — the mandatory data protection rules of your country apply.

To exercise any of these rights, write to contact@morphihealth.com. We respond within the time your country’s law requires.